[SECURITY] Prevent XSS in scheduler form

The class name is submitted in a hidden form and is susceptible to XSS.
The patch introduced htmlspecialchars to prevent XSS possibility.

Resolves: #57603
Releases: 6.2, 6.1, 6.0, 4.7, 4.5
Change-Id: I4979e66f28a581e168c56d91327a1bbe2672448d
Reviewed-on: https://review.typo3.org/29121
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[BUGFIX] PHP warning due to missing preg_quote

Fixing a missing preg_quote() call in ExtensionManagementUtility,
which causes a PHP warning and a failing preg_match().

Resolves: #55662
Releases: 6.2
Change-Id: Iaf1e21546741ae282016f433bf83f7e5663e3c7b
Reviewed-on: https://review.typo3.org/29145
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Pascal Dürsteler
Tested-by: Pascal Dürsteler
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[TASK] Return to "Admin Tools > User Admin" when exiting simulated BE User

When exiting a simulated BE user, you return to the backend user module
instead of the default startup page.

Resolves: #22020
Releases: 6.2
Change-Id: I8de7b6f79e6ddb9bc03f62364f3246ef13a4ddf3
Reviewed-on: https://review.typo3.org/28689
Reviewed-by: Markus Klein
Reviewed-by: Philipp Gampe
Tested-by: Philipp Gampe
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[TASK] Avoid sysLog calls in MailUtilityTest

Resolves: #57676
Releases: 6.2
Change-Id: I6f694a2c595756595b09aa4a8a91cb795e8a47b7
Reviewed-on: https://review.typo3.org/29192
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
Reviewed-by: Oliver Klee
Reviewed-by: Pascal Dürsteler
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[TASK] Activate all packages in unit tests

Introduce a new package manager class for unit tests
that does not read the PackageState.php file any more
but scans for packages and activates them,
so that the class loader can find the classes of all
extensions even if the according extension is not active in
the current TYPO3 installation.

Since the unit test bootstrap does not read other
extension files (ext_localconf.php, etc.) any more,
we can be sure that this does not introduce any
further side effects.

Since the PackageStates.php file will then be obsolete,
it will be removed from the travis integration repository.

Resolves: #57487
Releases: 6.2
Change-Id: Id0cd50db68fd94a31a996496fd5c54049ca94e78
Reviewed-on: https://review.typo3.org/29036
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[TASK] Improve deprecation msg of GeneralUtility method

The deprecation message of GeneralUtility::array_merge_recursive_overrule
should show more clearly that the code can't be just updated by
changing class + method name as there is no return value anymore.

This is new in the core and is a quite big risk!

Resolves: #57499
Releases: 6.2
Change-Id: I109a0c3edbc241708e7b362a249b6d0e4a79978e
Reviewed-on: https://review.typo3.org/29035
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] Fix incomplete mocking in ExtensionManagementUtilityTest

Some tests rely on actual extensions TCA being present.
Mock the method that reads the TCA files.

Resolves: #57700
Related: #57487
Releases: 6.2
Change-Id: I66cce578983fafc1bfe5a29cc0387b2e3d749873
Reviewed-on: https://review.typo3.org/29221
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel
[BUGFIX] User settings do not obey setup.override

Add a missing isset() check whether a setting has been overridden
by user TSconfig.

Resolves: #57690
Releases: 6.2, 6.1
Change-Id: Id1290b2af85061051ce0cedff4a0be96a91c4dce
Reviewed-on: https://review.typo3.org/29239
Reviewed-by: Renzo Bauen
Tested-by: Renzo Bauen
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[BUGFIX] T3editor description loading

Due to the refactoring of the ajax registration a wrong
method is registered for retrieving the description in t3editor.

Resolves: #57708
Releases: 6.2
Change-Id: I4eff5fe9475151439ad4e3cae26c874f69694ac5
Reviewed-on: https://review.typo3.org/29237
Reviewed-by: Stefan Neufeind
Tested-by: Stefan Neufeind
[BUGFIX] Use return values of array_map in local driver

The LocalDriver will now use the return values of array_map calls in
createFolder() and determineBaseUrl() so that the values are really
sanitized / url encoded.

Resolves: #57415
Releases: 6.2
Change-Id: I8aa1a79c6e4a7fe6c2d82ec66c12338e75a35872
Reviewed-on: https://review.typo3.org/28940
Reviewed-by: Frans Saris
Tested-by: Frans Saris
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] sql_free_result does not work with all allowed types

sql_free_result throws a fatal error when called with a
boolean. According to the method description boolean is an
allowed type. Check if $res is an object.

Change-Id: I6f7cdbb42c07869a320510e9b0b779f2b7cf6b70
Resolves: #50378
Releases: 6.2, 6.1
Reviewed-on: https://review.typo3.org/22594
Reviewed-by: Dan Untenzu
Tested-by: Dan Untenzu
Reviewed-by: Christian Kuhn
Reviewed-by: Stefan Neufeind
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[BUGFIX] Don't run processIncludes more than once

processIncludes() is run "mandatory" from the stack ->start()
->runThroughTemplates() and doing all the work that needs to be done.

Resolves: #54903
Releases: 6.2
Change-Id: Id2be1a25aa23a05849297315c74358a9ef4ff9bb
Reviewed-on: https://review.typo3.org/26748
Reviewed-by: Alexander Opitz
Tested-by: Alexander Opitz
Reviewed-by: Oliver Klee
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[CLEANUP] Code style of authentication classes

Clean up the source code of the authentication classes.
This patch does not change any functionality.
It serves as a basis for further improvements.

Resolves: #57788
Releases: 6.2
Change-Id: I555456c28da6697398a15ad9718a162f98aef61a
Reviewed-on: https://review.typo3.org/29322
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[CLEANUP] Remove deprecated filemount functions in BE_USER

With the introduction of the file abstraction layer,
the filemount functionality was deprecated in 6.0
but wasn't removed.

However, the usage of addFileMount() in  rtehtmlarea and
EXT:recordlist is now removed, since the added filemounts
are never read anywhere, so this is only dead code.

The functionality needs to be re-implemented.

Releases: 6.2
Resolves: #56772
Change-Id: I20ec66f46f15a785f5014cb625dabef711fae0a1
Reviewed-on: https://review.typo3.org/28265
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Oliver Klee
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
[BUGFIX] Follow up foreign_match_fields not fully supported

On detaching related objects the foreign_match_fields needs
to be cleared.

Resolves: #47694
Relates: #45337
Releases: 6.2, 6.1
Change-Id: I6d74201afc437a2b0e2a73022bc71ed0cd1dd2d4
Reviewed-on: https://review.typo3.org/26694
Reviewed-by: Wouter Wolters
Reviewed-by: Anja Leichsenring
Tested-by: Anja Leichsenring
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[CLEANUP] Error handling classes

* fixes CGL issues in annotations,
* fixes wrong annotations,
* introduces use statements

Resolves: #57661
Releases: 6.2
Change-Id: I41363888c523aedd13a795572d8c66430c0f34e3
Reviewed-on: https://review.typo3.org/29178
Reviewed-by: Markus Klein
Tested-by: Markus Klein
Reviewed-by: Oliver Klee
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[CLEANUP] Fix length of comments to meet CGL

Resolves: #57819
Releases: 6.2
Change-Id: I24a860dda49504e8745fe195f74c519a73a22991
Reviewed-on: https://review.typo3.org/29376
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Markus Klein
Tested-by: Markus Klein
[TASK] Improve comments and phpdoc blocks in PageRepository

* fix comment line lengths to improve readability and meet the CGL
* add some additional line breaks in comments to improve readability
* add missing @throws annotations in phpdoc blocks
* add missing @var annotations in phpdoc blocks

Resolves: #57859
Releases: 6.2
Change-Id: I311c6c858c8810b4a8906918378629aef5e1ebc8
Reviewed-on: https://review.typo3.org/29425
Reviewed-by: Oliver Klee
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[BUGFIX] Improve database scheme updater

This patch improves the update process as it removes the hard stop after
an SQL error occurred. All queries should get executed and errors should
be reported at the end. Sometimes it gets necessary that the updater is
called more that once - a notice to the user is added.

Besides the index length is reduced by 1 to ensure the index is set
with limitation in the database and all fields can be updated in the
second step.

Resolves: #57421
Releases: 6.2
Change-Id: I2f830a8a62b8dff3fbe949d40de8ddc30f3dfb9a
Reviewed-on: https://review.typo3.org/28945
Reviewed-by: Jigal van Hemert
Tested-by: Jigal van Hemert
Reviewed-by: Dmitry Dulepov
Tested-by: Dmitry Dulepov
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
[CLEANUP] Improve comments in TypoScriptFrontendController

Resolves: #57814
Releases: 6.2
Change-Id: I0f92a0695f5897eb0311f68bfd21ebb40d9303d8
Reviewed-on: https://review.typo3.org/29355
Reviewed-by: Christian Kuhn
Tested-by: Christian Kuhn
Reviewed-by: Oliver Klee
Reviewed-by: Helmut Hummel
Tested-by: Helmut Hummel